Metalama vulnerabilities
CVEs whose affected-version data names the Metalama package (nuget). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-62848High· 7.3Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restrictin…
▾ Twilightmetalama · MetalamaEPSS 0.19%via CVEORG
CVE-2026-62847High· 8.2Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and e…
▾ Twilightmetalama · MetalamaEPSS 0.15%via CVEORG